{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32357", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-03-12T11:10:47.069Z", "datePublished": "2026-03-13T11:42:01.168Z", "dateUpdated": "2026-04-29T09:51:57.855Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "simple-blog-card", "product": "Simple Blog Card", "vendor": "Katsushi Kawamori", "versions": [{"changes": [{"at": "2.38", "status": "unaffected"}], "lessThanOrEqual": "2.37", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:04:40.703Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.<p>This issue affects Simple Blog Card: from n/a through <= 2.37.</p>"}], "value": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-29T09:51:57.855Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "title": "WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability"}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T13:54:56.728138Z", "id": "CVE-2026-32357", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:55:19.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32357", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T13:54:56.728138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T13:54:11.354Z"}}], "cna": {"title": "WordPress Simple Blog Card plugin <= 2.37 - Server Side Request Forgery (SSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "affected": [{"vendor": "Katsushi Kawamori", "product": "Simple Blog Card", "versions": [{"status": "affected", "changes": [{"at": "2.38", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "2.37"}], "packageName": "simple-blog-card", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:04:40.703Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37.", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.<p>This issue affects Simple Blog Card: from n/a through <= 2.37.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-01T14:15:58.284Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32357", "state": "PUBLISHED", "dateUpdated": "2026-04-01T14:15:58.284Z", "dateReserved": "2026-03-12T11:10:47.069Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-13T11:42:01.168Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Katsushi Kawamori Simple Blog Card simple-blog-card allows Server Side Request Forgery.This issue affects Simple Blog Card: from n/a through <= 2.37."}, {"lang": "es", "value": "Vulnerabilidad de Falsificaci\u00f3n de Petici\u00f3n del Lado del Servidor (SSRF) en Katsushi Kawamori Simple Blog Card simple-blog-card permite falsificaci\u00f3n de petici\u00f3n del lado del servidor. Este problema afecta a Simple Blog Card: desde n/a hasta &lt;= 2.37."}], "id": "CVE-2026-32357", "lastModified": "2026-04-22T21:30:26.497", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-13T19:54:49.337", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/simple-blog-card/vulnerability/wordpress-simple-blog-card-plugin-2-37-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.37]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Simple Blog Card", "source": "cna", "vendor": "Katsushi Kawamori"}, "product": "simple_blog_card", "vendor": "katsushi_kawamori"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T18:24:32.762262+00:00", "value": {"mitigation_remediation": ["Update the Simple Blog Card plugin to the latest available version (if newer than 2.37) as soon as a patch is released.", "If an update is not immediately available, temporarily disable or delete the plugin to eliminate the SSRF risk.", "Regularly check the vendor\u2019s website or security advisory feeds for any new patches or mitigation information."], "summary": {"action": "Immediate Patch", "impact": "Server Side Request Forgery"}, "threat_synthesis": {"affected_systems": "All released versions of the Katsushi Kawamori Simple Blog Card plugin, from the earliest available version up to and including version 2.37, are affected. No higher\u2011numbered version has been documented as providing a fix in the supplied data.", "description_and_impact": "The Simple Blog Card plugin for WordPress, created by Katsushi Kawamori, contains a Server\u2011Side Request Forgery (SSRF) flaw that permits the server to issue HTTP requests to arbitrary URLs. According to the CVE description, this weakness arises from insufficient validation of user\u2011supplied URLs, allowing an attacker to initiate internal network requests or exfiltrate data, thereby jeopardizing confidentiality and potentially affecting integrity of exposed services.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity. The EPSS score is reported as less than 1%, suggesting a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating limited active exploitation. The provided description does not specify authentication requirements; it is inferred that the SSRF can be triggered via a publicly accessible plugin interface without special conditions, although this is not explicitly stated by the vendor."}}}}, "created": "2026-03-16T09:34:50.088116+00:00", "updated": "2026-03-23T09:58:59.860614+00:00", "vendors": ["katsushi_kawamori", "katsushi_kawamori$PRODUCT$simple_blog_card", "wordpress", "wordpress$PRODUCT$wordpress"]}